|
1 theory Proof |
|
2 imports Base Main |
|
3 begin |
|
4 |
|
5 chapter {* Proofs \label{ch:proofs} *} |
|
6 |
|
7 text {* |
|
8 Proof commands perform transitions of Isar/VM machine |
|
9 configurations, which are block-structured, consisting of a stack of |
|
10 nodes with three main components: logical proof context, current |
|
11 facts, and open goals. Isar/VM transitions are typed according to |
|
12 the following three different modes of operation: |
|
13 |
|
14 \begin{description} |
|
15 |
|
16 \item @{text "proof(prove)"} means that a new goal has just been |
|
17 stated that is now to be \emph{proven}; the next command may refine |
|
18 it by some proof method, and enter a sub-proof to establish the |
|
19 actual result. |
|
20 |
|
21 \item @{text "proof(state)"} is like a nested theory mode: the |
|
22 context may be augmented by \emph{stating} additional assumptions, |
|
23 intermediate results etc. |
|
24 |
|
25 \item @{text "proof(chain)"} is intermediate between @{text |
|
26 "proof(state)"} and @{text "proof(prove)"}: existing facts (i.e.\ |
|
27 the contents of the special ``@{fact_ref this}'' register) have been |
|
28 just picked up in order to be used when refining the goal claimed |
|
29 next. |
|
30 |
|
31 \end{description} |
|
32 |
|
33 The proof mode indicator may be understood as an instruction to the |
|
34 writer, telling what kind of operation may be performed next. The |
|
35 corresponding typings of proof commands restricts the shape of |
|
36 well-formed proof texts to particular command sequences. So dynamic |
|
37 arrangements of commands eventually turn out as static texts of a |
|
38 certain structure. |
|
39 |
|
40 \Appref{ap:refcard} gives a simplified grammar of the (extensible) |
|
41 language emerging that way from the different types of proof |
|
42 commands. The main ideas of the overall Isar framework are |
|
43 explained in \chref{ch:isar-framework}. |
|
44 *} |
|
45 |
|
46 |
|
47 section {* Proof structure *} |
|
48 |
|
49 subsection {* Formal notepad *} |
|
50 |
|
51 text {* |
|
52 \begin{matharray}{rcl} |
|
53 @{command_def "notepad"} & : & @{text "local_theory \<rightarrow> proof(state)"} \\ |
|
54 \end{matharray} |
|
55 |
|
56 @{rail " |
|
57 @@{command notepad} @'begin' |
|
58 ; |
|
59 @@{command end} |
|
60 "} |
|
61 |
|
62 \begin{description} |
|
63 |
|
64 \item @{command "notepad"}~@{keyword "begin"} opens a proof state |
|
65 without any goal statement. This allows to experiment with Isar, |
|
66 without producing any persistent result. |
|
67 |
|
68 The notepad can be closed by @{command "end"} or discontinued by |
|
69 @{command "oops"}. |
|
70 |
|
71 \end{description} |
|
72 *} |
|
73 |
|
74 |
|
75 subsection {* Blocks *} |
|
76 |
|
77 text {* |
|
78 \begin{matharray}{rcl} |
|
79 @{command_def "next"} & : & @{text "proof(state) \<rightarrow> proof(state)"} \\ |
|
80 @{command_def "{"} & : & @{text "proof(state) \<rightarrow> proof(state)"} \\ |
|
81 @{command_def "}"} & : & @{text "proof(state) \<rightarrow> proof(state)"} \\ |
|
82 \end{matharray} |
|
83 |
|
84 While Isar is inherently block-structured, opening and closing |
|
85 blocks is mostly handled rather casually, with little explicit |
|
86 user-intervention. Any local goal statement automatically opens |
|
87 \emph{two} internal blocks, which are closed again when concluding |
|
88 the sub-proof (by @{command "qed"} etc.). Sections of different |
|
89 context within a sub-proof may be switched via @{command "next"}, |
|
90 which is just a single block-close followed by block-open again. |
|
91 The effect of @{command "next"} is to reset the local proof context; |
|
92 there is no goal focus involved here! |
|
93 |
|
94 For slightly more advanced applications, there are explicit block |
|
95 parentheses as well. These typically achieve a stronger forward |
|
96 style of reasoning. |
|
97 |
|
98 \begin{description} |
|
99 |
|
100 \item @{command "next"} switches to a fresh block within a |
|
101 sub-proof, resetting the local context to the initial one. |
|
102 |
|
103 \item @{command "{"} and @{command "}"} explicitly open and close |
|
104 blocks. Any current facts pass through ``@{command "{"}'' |
|
105 unchanged, while ``@{command "}"}'' causes any result to be |
|
106 \emph{exported} into the enclosing context. Thus fixed variables |
|
107 are generalized, assumptions discharged, and local definitions |
|
108 unfolded (cf.\ \secref{sec:proof-context}). There is no difference |
|
109 of @{command "assume"} and @{command "presume"} in this mode of |
|
110 forward reasoning --- in contrast to plain backward reasoning with |
|
111 the result exported at @{command "show"} time. |
|
112 |
|
113 \end{description} |
|
114 *} |
|
115 |
|
116 |
|
117 subsection {* Omitting proofs *} |
|
118 |
|
119 text {* |
|
120 \begin{matharray}{rcl} |
|
121 @{command_def "oops"} & : & @{text "proof \<rightarrow> local_theory | theory"} \\ |
|
122 \end{matharray} |
|
123 |
|
124 The @{command "oops"} command discontinues the current proof |
|
125 attempt, while considering the partial proof text as properly |
|
126 processed. This is conceptually quite different from ``faking'' |
|
127 actual proofs via @{command_ref "sorry"} (see |
|
128 \secref{sec:proof-steps}): @{command "oops"} does not observe the |
|
129 proof structure at all, but goes back right to the theory level. |
|
130 Furthermore, @{command "oops"} does not produce any result theorem |
|
131 --- there is no intended claim to be able to complete the proof |
|
132 in any way. |
|
133 |
|
134 A typical application of @{command "oops"} is to explain Isar proofs |
|
135 \emph{within} the system itself, in conjunction with the document |
|
136 preparation tools of Isabelle described in \chref{ch:document-prep}. |
|
137 Thus partial or even wrong proof attempts can be discussed in a |
|
138 logically sound manner. Note that the Isabelle {\LaTeX} macros can |
|
139 be easily adapted to print something like ``@{text "\<dots>"}'' instead of |
|
140 the keyword ``@{command "oops"}''. |
|
141 *} |
|
142 |
|
143 |
|
144 section {* Statements *} |
|
145 |
|
146 subsection {* Context elements \label{sec:proof-context} *} |
|
147 |
|
148 text {* |
|
149 \begin{matharray}{rcl} |
|
150 @{command_def "fix"} & : & @{text "proof(state) \<rightarrow> proof(state)"} \\ |
|
151 @{command_def "assume"} & : & @{text "proof(state) \<rightarrow> proof(state)"} \\ |
|
152 @{command_def "presume"} & : & @{text "proof(state) \<rightarrow> proof(state)"} \\ |
|
153 @{command_def "def"} & : & @{text "proof(state) \<rightarrow> proof(state)"} \\ |
|
154 \end{matharray} |
|
155 |
|
156 The logical proof context consists of fixed variables and |
|
157 assumptions. The former closely correspond to Skolem constants, or |
|
158 meta-level universal quantification as provided by the Isabelle/Pure |
|
159 logical framework. Introducing some \emph{arbitrary, but fixed} |
|
160 variable via ``@{command "fix"}~@{text x}'' results in a local value |
|
161 that may be used in the subsequent proof as any other variable or |
|
162 constant. Furthermore, any result @{text "\<turnstile> \<phi>[x]"} exported from |
|
163 the context will be universally closed wrt.\ @{text x} at the |
|
164 outermost level: @{text "\<turnstile> \<And>x. \<phi>[x]"} (this is expressed in normal |
|
165 form using Isabelle's meta-variables). |
|
166 |
|
167 Similarly, introducing some assumption @{text \<chi>} has two effects. |
|
168 On the one hand, a local theorem is created that may be used as a |
|
169 fact in subsequent proof steps. On the other hand, any result |
|
170 @{text "\<chi> \<turnstile> \<phi>"} exported from the context becomes conditional wrt.\ |
|
171 the assumption: @{text "\<turnstile> \<chi> \<Longrightarrow> \<phi>"}. Thus, solving an enclosing goal |
|
172 using such a result would basically introduce a new subgoal stemming |
|
173 from the assumption. How this situation is handled depends on the |
|
174 version of assumption command used: while @{command "assume"} |
|
175 insists on solving the subgoal by unification with some premise of |
|
176 the goal, @{command "presume"} leaves the subgoal unchanged in order |
|
177 to be proved later by the user. |
|
178 |
|
179 Local definitions, introduced by ``@{command "def"}~@{text "x \<equiv> |
|
180 t"}'', are achieved by combining ``@{command "fix"}~@{text x}'' with |
|
181 another version of assumption that causes any hypothetical equation |
|
182 @{text "x \<equiv> t"} to be eliminated by the reflexivity rule. Thus, |
|
183 exporting some result @{text "x \<equiv> t \<turnstile> \<phi>[x]"} yields @{text "\<turnstile> |
|
184 \<phi>[t]"}. |
|
185 |
|
186 @{rail " |
|
187 @@{command fix} (@{syntax vars} + @'and') |
|
188 ; |
|
189 (@@{command assume} | @@{command presume}) (@{syntax props} + @'and') |
|
190 ; |
|
191 @@{command def} (def + @'and') |
|
192 ; |
|
193 def: @{syntax thmdecl}? \\ @{syntax name} ('==' | '\<equiv>') @{syntax term} @{syntax term_pat}? |
|
194 "} |
|
195 |
|
196 \begin{description} |
|
197 |
|
198 \item @{command "fix"}~@{text x} introduces a local variable @{text |
|
199 x} that is \emph{arbitrary, but fixed.} |
|
200 |
|
201 \item @{command "assume"}~@{text "a: \<phi>"} and @{command |
|
202 "presume"}~@{text "a: \<phi>"} introduce a local fact @{text "\<phi> \<turnstile> \<phi>"} by |
|
203 assumption. Subsequent results applied to an enclosing goal (e.g.\ |
|
204 by @{command_ref "show"}) are handled as follows: @{command |
|
205 "assume"} expects to be able to unify with existing premises in the |
|
206 goal, while @{command "presume"} leaves @{text \<phi>} as new subgoals. |
|
207 |
|
208 Several lists of assumptions may be given (separated by |
|
209 @{keyword_ref "and"}; the resulting list of current facts consists |
|
210 of all of these concatenated. |
|
211 |
|
212 \item @{command "def"}~@{text "x \<equiv> t"} introduces a local |
|
213 (non-polymorphic) definition. In results exported from the context, |
|
214 @{text x} is replaced by @{text t}. Basically, ``@{command |
|
215 "def"}~@{text "x \<equiv> t"}'' abbreviates ``@{command "fix"}~@{text |
|
216 x}~@{command "assume"}~@{text "x \<equiv> t"}'', with the resulting |
|
217 hypothetical equation solved by reflexivity. |
|
218 |
|
219 The default name for the definitional equation is @{text x_def}. |
|
220 Several simultaneous definitions may be given at the same time. |
|
221 |
|
222 \end{description} |
|
223 |
|
224 The special name @{fact_ref prems} refers to all assumptions of the |
|
225 current context as a list of theorems. This feature should be used |
|
226 with great care! It is better avoided in final proof texts. |
|
227 *} |
|
228 |
|
229 |
|
230 subsection {* Term abbreviations \label{sec:term-abbrev} *} |
|
231 |
|
232 text {* |
|
233 \begin{matharray}{rcl} |
|
234 @{command_def "let"} & : & @{text "proof(state) \<rightarrow> proof(state)"} \\ |
|
235 @{keyword_def "is"} & : & syntax \\ |
|
236 \end{matharray} |
|
237 |
|
238 Abbreviations may be either bound by explicit @{command |
|
239 "let"}~@{text "p \<equiv> t"} statements, or by annotating assumptions or |
|
240 goal statements with a list of patterns ``@{text "(\<IS> p\<^sub>1 \<dots> |
|
241 p\<^sub>n)"}''. In both cases, higher-order matching is invoked to |
|
242 bind extra-logical term variables, which may be either named |
|
243 schematic variables of the form @{text ?x}, or nameless dummies |
|
244 ``@{variable _}'' (underscore). Note that in the @{command "let"} |
|
245 form the patterns occur on the left-hand side, while the @{keyword |
|
246 "is"} patterns are in postfix position. |
|
247 |
|
248 Polymorphism of term bindings is handled in Hindley-Milner style, |
|
249 similar to ML. Type variables referring to local assumptions or |
|
250 open goal statements are \emph{fixed}, while those of finished |
|
251 results or bound by @{command "let"} may occur in \emph{arbitrary} |
|
252 instances later. Even though actual polymorphism should be rarely |
|
253 used in practice, this mechanism is essential to achieve proper |
|
254 incremental type-inference, as the user proceeds to build up the |
|
255 Isar proof text from left to right. |
|
256 |
|
257 \medskip Term abbreviations are quite different from local |
|
258 definitions as introduced via @{command "def"} (see |
|
259 \secref{sec:proof-context}). The latter are visible within the |
|
260 logic as actual equations, while abbreviations disappear during the |
|
261 input process just after type checking. Also note that @{command |
|
262 "def"} does not support polymorphism. |
|
263 |
|
264 @{rail " |
|
265 @@{command let} ((@{syntax term} + @'and') '=' @{syntax term} + @'and') |
|
266 "} |
|
267 |
|
268 The syntax of @{keyword "is"} patterns follows @{syntax term_pat} or |
|
269 @{syntax prop_pat} (see \secref{sec:term-decls}). |
|
270 |
|
271 \begin{description} |
|
272 |
|
273 \item @{command "let"}~@{text "p\<^sub>1 = t\<^sub>1 \<AND> \<dots> p\<^sub>n = t\<^sub>n"} binds any |
|
274 text variables in patterns @{text "p\<^sub>1, \<dots>, p\<^sub>n"} by simultaneous |
|
275 higher-order matching against terms @{text "t\<^sub>1, \<dots>, t\<^sub>n"}. |
|
276 |
|
277 \item @{text "(\<IS> p\<^sub>1 \<dots> p\<^sub>n)"} resembles @{command "let"}, but |
|
278 matches @{text "p\<^sub>1, \<dots>, p\<^sub>n"} against the preceding statement. Also |
|
279 note that @{keyword "is"} is not a separate command, but part of |
|
280 others (such as @{command "assume"}, @{command "have"} etc.). |
|
281 |
|
282 \end{description} |
|
283 |
|
284 Some \emph{implicit} term abbreviations\index{term abbreviations} |
|
285 for goals and facts are available as well. For any open goal, |
|
286 @{variable_ref thesis} refers to its object-level statement, |
|
287 abstracted over any meta-level parameters (if present). Likewise, |
|
288 @{variable_ref this} is bound for fact statements resulting from |
|
289 assumptions or finished goals. In case @{variable this} refers to |
|
290 an object-logic statement that is an application @{text "f t"}, then |
|
291 @{text t} is bound to the special text variable ``@{variable "\<dots>"}'' |
|
292 (three dots). The canonical application of this convenience are |
|
293 calculational proofs (see \secref{sec:calculation}). |
|
294 *} |
|
295 |
|
296 |
|
297 subsection {* Facts and forward chaining \label{sec:proof-facts} *} |
|
298 |
|
299 text {* |
|
300 \begin{matharray}{rcl} |
|
301 @{command_def "note"} & : & @{text "proof(state) \<rightarrow> proof(state)"} \\ |
|
302 @{command_def "then"} & : & @{text "proof(state) \<rightarrow> proof(chain)"} \\ |
|
303 @{command_def "from"} & : & @{text "proof(state) \<rightarrow> proof(chain)"} \\ |
|
304 @{command_def "with"} & : & @{text "proof(state) \<rightarrow> proof(chain)"} \\ |
|
305 @{command_def "using"} & : & @{text "proof(prove) \<rightarrow> proof(prove)"} \\ |
|
306 @{command_def "unfolding"} & : & @{text "proof(prove) \<rightarrow> proof(prove)"} \\ |
|
307 \end{matharray} |
|
308 |
|
309 New facts are established either by assumption or proof of local |
|
310 statements. Any fact will usually be involved in further proofs, |
|
311 either as explicit arguments of proof methods, or when forward |
|
312 chaining towards the next goal via @{command "then"} (and variants); |
|
313 @{command "from"} and @{command "with"} are composite forms |
|
314 involving @{command "note"}. The @{command "using"} elements |
|
315 augments the collection of used facts \emph{after} a goal has been |
|
316 stated. Note that the special theorem name @{fact_ref this} refers |
|
317 to the most recently established facts, but only \emph{before} |
|
318 issuing a follow-up claim. |
|
319 |
|
320 @{rail " |
|
321 @@{command note} (@{syntax thmdef}? @{syntax thmrefs} + @'and') |
|
322 ; |
|
323 (@@{command from} | @@{command with} | @@{command using} | @@{command unfolding}) |
|
324 (@{syntax thmrefs} + @'and') |
|
325 "} |
|
326 |
|
327 \begin{description} |
|
328 |
|
329 \item @{command "note"}~@{text "a = b\<^sub>1 \<dots> b\<^sub>n"} recalls existing facts |
|
330 @{text "b\<^sub>1, \<dots>, b\<^sub>n"}, binding the result as @{text a}. Note that |
|
331 attributes may be involved as well, both on the left and right hand |
|
332 sides. |
|
333 |
|
334 \item @{command "then"} indicates forward chaining by the current |
|
335 facts in order to establish the goal to be claimed next. The |
|
336 initial proof method invoked to refine that will be offered the |
|
337 facts to do ``anything appropriate'' (see also |
|
338 \secref{sec:proof-steps}). For example, method @{method (Pure) rule} |
|
339 (see \secref{sec:pure-meth-att}) would typically do an elimination |
|
340 rather than an introduction. Automatic methods usually insert the |
|
341 facts into the goal state before operation. This provides a simple |
|
342 scheme to control relevance of facts in automated proof search. |
|
343 |
|
344 \item @{command "from"}~@{text b} abbreviates ``@{command |
|
345 "note"}~@{text b}~@{command "then"}''; thus @{command "then"} is |
|
346 equivalent to ``@{command "from"}~@{text this}''. |
|
347 |
|
348 \item @{command "with"}~@{text "b\<^sub>1 \<dots> b\<^sub>n"} abbreviates ``@{command |
|
349 "from"}~@{text "b\<^sub>1 \<dots> b\<^sub>n \<AND> this"}''; thus the forward chaining |
|
350 is from earlier facts together with the current ones. |
|
351 |
|
352 \item @{command "using"}~@{text "b\<^sub>1 \<dots> b\<^sub>n"} augments the facts being |
|
353 currently indicated for use by a subsequent refinement step (such as |
|
354 @{command_ref "apply"} or @{command_ref "proof"}). |
|
355 |
|
356 \item @{command "unfolding"}~@{text "b\<^sub>1 \<dots> b\<^sub>n"} is structurally |
|
357 similar to @{command "using"}, but unfolds definitional equations |
|
358 @{text "b\<^sub>1, \<dots> b\<^sub>n"} throughout the goal state and facts. |
|
359 |
|
360 \end{description} |
|
361 |
|
362 Forward chaining with an empty list of theorems is the same as not |
|
363 chaining at all. Thus ``@{command "from"}~@{text nothing}'' has no |
|
364 effect apart from entering @{text "prove(chain)"} mode, since |
|
365 @{fact_ref nothing} is bound to the empty list of theorems. |
|
366 |
|
367 Basic proof methods (such as @{method_ref (Pure) rule}) expect multiple |
|
368 facts to be given in their proper order, corresponding to a prefix |
|
369 of the premises of the rule involved. Note that positions may be |
|
370 easily skipped using something like @{command "from"}~@{text "_ |
|
371 \<AND> a \<AND> b"}, for example. This involves the trivial rule |
|
372 @{text "PROP \<psi> \<Longrightarrow> PROP \<psi>"}, which is bound in Isabelle/Pure as |
|
373 ``@{fact_ref "_"}'' (underscore). |
|
374 |
|
375 Automated methods (such as @{method simp} or @{method auto}) just |
|
376 insert any given facts before their usual operation. Depending on |
|
377 the kind of procedure involved, the order of facts is less |
|
378 significant here. |
|
379 *} |
|
380 |
|
381 |
|
382 subsection {* Goals \label{sec:goals} *} |
|
383 |
|
384 text {* |
|
385 \begin{matharray}{rcl} |
|
386 @{command_def "lemma"} & : & @{text "local_theory \<rightarrow> proof(prove)"} \\ |
|
387 @{command_def "theorem"} & : & @{text "local_theory \<rightarrow> proof(prove)"} \\ |
|
388 @{command_def "corollary"} & : & @{text "local_theory \<rightarrow> proof(prove)"} \\ |
|
389 @{command_def "schematic_lemma"} & : & @{text "local_theory \<rightarrow> proof(prove)"} \\ |
|
390 @{command_def "schematic_theorem"} & : & @{text "local_theory \<rightarrow> proof(prove)"} \\ |
|
391 @{command_def "schematic_corollary"} & : & @{text "local_theory \<rightarrow> proof(prove)"} \\ |
|
392 @{command_def "have"} & : & @{text "proof(state) | proof(chain) \<rightarrow> proof(prove)"} \\ |
|
393 @{command_def "show"} & : & @{text "proof(state) | proof(chain) \<rightarrow> proof(prove)"} \\ |
|
394 @{command_def "hence"} & : & @{text "proof(state) \<rightarrow> proof(prove)"} \\ |
|
395 @{command_def "thus"} & : & @{text "proof(state) \<rightarrow> proof(prove)"} \\ |
|
396 @{command_def "print_statement"}@{text "\<^sup>*"} & : & @{text "context \<rightarrow>"} \\ |
|
397 \end{matharray} |
|
398 |
|
399 From a theory context, proof mode is entered by an initial goal |
|
400 command such as @{command "lemma"}, @{command "theorem"}, or |
|
401 @{command "corollary"}. Within a proof, new claims may be |
|
402 introduced locally as well; four variants are available here to |
|
403 indicate whether forward chaining of facts should be performed |
|
404 initially (via @{command_ref "then"}), and whether the final result |
|
405 is meant to solve some pending goal. |
|
406 |
|
407 Goals may consist of multiple statements, resulting in a list of |
|
408 facts eventually. A pending multi-goal is internally represented as |
|
409 a meta-level conjunction (@{text "&&&"}), which is usually |
|
410 split into the corresponding number of sub-goals prior to an initial |
|
411 method application, via @{command_ref "proof"} |
|
412 (\secref{sec:proof-steps}) or @{command_ref "apply"} |
|
413 (\secref{sec:tactic-commands}). The @{method_ref induct} method |
|
414 covered in \secref{sec:cases-induct} acts on multiple claims |
|
415 simultaneously. |
|
416 |
|
417 Claims at the theory level may be either in short or long form. A |
|
418 short goal merely consists of several simultaneous propositions |
|
419 (often just one). A long goal includes an explicit context |
|
420 specification for the subsequent conclusion, involving local |
|
421 parameters and assumptions. Here the role of each part of the |
|
422 statement is explicitly marked by separate keywords (see also |
|
423 \secref{sec:locale}); the local assumptions being introduced here |
|
424 are available as @{fact_ref assms} in the proof. Moreover, there |
|
425 are two kinds of conclusions: @{element_def "shows"} states several |
|
426 simultaneous propositions (essentially a big conjunction), while |
|
427 @{element_def "obtains"} claims several simultaneous simultaneous |
|
428 contexts of (essentially a big disjunction of eliminated parameters |
|
429 and assumptions, cf.\ \secref{sec:obtain}). |
|
430 |
|
431 @{rail " |
|
432 (@@{command lemma} | @@{command theorem} | @@{command corollary} | |
|
433 @@{command schematic_lemma} | @@{command schematic_theorem} | |
|
434 @@{command schematic_corollary}) @{syntax target}? (goal | longgoal) |
|
435 ; |
|
436 (@@{command have} | @@{command show} | @@{command hence} | @@{command thus}) goal |
|
437 ; |
|
438 @@{command print_statement} @{syntax modes}? @{syntax thmrefs} |
|
439 ; |
|
440 |
|
441 goal: (@{syntax props} + @'and') |
|
442 ; |
|
443 longgoal: @{syntax thmdecl}? (@{syntax_ref \"includes\"}?) (@{syntax context_elem} * ) conclusion |
|
444 ; |
|
445 conclusion: @'shows' goal | @'obtains' (@{syntax parname}? case + '|') |
|
446 ; |
|
447 case: (@{syntax vars} + @'and') @'where' (@{syntax props} + @'and') |
|
448 "} |
|
449 |
|
450 \begin{description} |
|
451 |
|
452 \item @{command "lemma"}~@{text "a: \<phi>"} enters proof mode with |
|
453 @{text \<phi>} as main goal, eventually resulting in some fact @{text "\<turnstile> |
|
454 \<phi>"} to be put back into the target context. An additional @{syntax |
|
455 context} specification may build up an initial proof context for the |
|
456 subsequent claim; this includes local definitions and syntax as |
|
457 well, see also @{syntax "includes"} in \secref{sec:bundle} and |
|
458 @{syntax context_elem} in \secref{sec:locale}. |
|
459 |
|
460 \item @{command "theorem"}~@{text "a: \<phi>"} and @{command |
|
461 "corollary"}~@{text "a: \<phi>"} are essentially the same as @{command |
|
462 "lemma"}~@{text "a: \<phi>"}, but the facts are internally marked as |
|
463 being of a different kind. This discrimination acts like a formal |
|
464 comment. |
|
465 |
|
466 \item @{command "schematic_lemma"}, @{command "schematic_theorem"}, |
|
467 @{command "schematic_corollary"} are similar to @{command "lemma"}, |
|
468 @{command "theorem"}, @{command "corollary"}, respectively but allow |
|
469 the statement to contain unbound schematic variables. |
|
470 |
|
471 Under normal circumstances, an Isar proof text needs to specify |
|
472 claims explicitly. Schematic goals are more like goals in Prolog, |
|
473 where certain results are synthesized in the course of reasoning. |
|
474 With schematic statements, the inherent compositionality of Isar |
|
475 proofs is lost, which also impacts performance, because proof |
|
476 checking is forced into sequential mode. |
|
477 |
|
478 \item @{command "have"}~@{text "a: \<phi>"} claims a local goal, |
|
479 eventually resulting in a fact within the current logical context. |
|
480 This operation is completely independent of any pending sub-goals of |
|
481 an enclosing goal statements, so @{command "have"} may be freely |
|
482 used for experimental exploration of potential results within a |
|
483 proof body. |
|
484 |
|
485 \item @{command "show"}~@{text "a: \<phi>"} is like @{command |
|
486 "have"}~@{text "a: \<phi>"} plus a second stage to refine some pending |
|
487 sub-goal for each one of the finished result, after having been |
|
488 exported into the corresponding context (at the head of the |
|
489 sub-proof of this @{command "show"} command). |
|
490 |
|
491 To accommodate interactive debugging, resulting rules are printed |
|
492 before being applied internally. Even more, interactive execution |
|
493 of @{command "show"} predicts potential failure and displays the |
|
494 resulting error as a warning beforehand. Watch out for the |
|
495 following message: |
|
496 |
|
497 %FIXME proper antiquitation |
|
498 \begin{ttbox} |
|
499 Problem! Local statement will fail to solve any pending goal |
|
500 \end{ttbox} |
|
501 |
|
502 \item @{command "hence"} abbreviates ``@{command "then"}~@{command |
|
503 "have"}'', i.e.\ claims a local goal to be proven by forward |
|
504 chaining the current facts. Note that @{command "hence"} is also |
|
505 equivalent to ``@{command "from"}~@{text this}~@{command "have"}''. |
|
506 |
|
507 \item @{command "thus"} abbreviates ``@{command "then"}~@{command |
|
508 "show"}''. Note that @{command "thus"} is also equivalent to |
|
509 ``@{command "from"}~@{text this}~@{command "show"}''. |
|
510 |
|
511 \item @{command "print_statement"}~@{text a} prints facts from the |
|
512 current theory or proof context in long statement form, according to |
|
513 the syntax for @{command "lemma"} given above. |
|
514 |
|
515 \end{description} |
|
516 |
|
517 Any goal statement causes some term abbreviations (such as |
|
518 @{variable_ref "?thesis"}) to be bound automatically, see also |
|
519 \secref{sec:term-abbrev}. |
|
520 |
|
521 The optional case names of @{element_ref "obtains"} have a twofold |
|
522 meaning: (1) during the of this claim they refer to the the local |
|
523 context introductions, (2) the resulting rule is annotated |
|
524 accordingly to support symbolic case splits when used with the |
|
525 @{method_ref cases} method (cf.\ \secref{sec:cases-induct}). |
|
526 *} |
|
527 |
|
528 |
|
529 section {* Refinement steps *} |
|
530 |
|
531 subsection {* Proof method expressions \label{sec:proof-meth} *} |
|
532 |
|
533 text {* Proof methods are either basic ones, or expressions composed |
|
534 of methods via ``@{verbatim ","}'' (sequential composition), |
|
535 ``@{verbatim "|"}'' (alternative choices), ``@{verbatim "?"}'' |
|
536 (try), ``@{verbatim "+"}'' (repeat at least once), ``@{verbatim |
|
537 "["}@{text n}@{verbatim "]"}'' (restriction to first @{text n} |
|
538 sub-goals, with default @{text "n = 1"}). In practice, proof |
|
539 methods are usually just a comma separated list of @{syntax |
|
540 nameref}~@{syntax args} specifications. Note that parentheses may |
|
541 be dropped for single method specifications (with no arguments). |
|
542 |
|
543 @{rail " |
|
544 @{syntax_def method}: |
|
545 (@{syntax nameref} | '(' methods ')') (() | '?' | '+' | '[' @{syntax nat}? ']') |
|
546 ; |
|
547 methods: (@{syntax nameref} @{syntax args} | @{syntax method}) + (',' | '|') |
|
548 "} |
|
549 |
|
550 Proper Isar proof methods do \emph{not} admit arbitrary goal |
|
551 addressing, but refer either to the first sub-goal or all sub-goals |
|
552 uniformly. The goal restriction operator ``@{text "[n]"}'' |
|
553 evaluates a method expression within a sandbox consisting of the |
|
554 first @{text n} sub-goals (which need to exist). For example, the |
|
555 method ``@{text "simp_all[3]"}'' simplifies the first three |
|
556 sub-goals, while ``@{text "(rule foo, simp_all)[]"}'' simplifies all |
|
557 new goals that emerge from applying rule @{text "foo"} to the |
|
558 originally first one. |
|
559 |
|
560 Improper methods, notably tactic emulations, offer a separate |
|
561 low-level goal addressing scheme as explicit argument to the |
|
562 individual tactic being involved. Here ``@{text "[!]"}'' refers to |
|
563 all goals, and ``@{text "[n-]"}'' to all goals starting from @{text |
|
564 "n"}. |
|
565 |
|
566 @{rail " |
|
567 @{syntax_def goal_spec}: |
|
568 '[' (@{syntax nat} '-' @{syntax nat} | @{syntax nat} '-' | @{syntax nat} | '!' ) ']' |
|
569 "} |
|
570 *} |
|
571 |
|
572 |
|
573 subsection {* Initial and terminal proof steps \label{sec:proof-steps} *} |
|
574 |
|
575 text {* |
|
576 \begin{matharray}{rcl} |
|
577 @{command_def "proof"} & : & @{text "proof(prove) \<rightarrow> proof(state)"} \\ |
|
578 @{command_def "qed"} & : & @{text "proof(state) \<rightarrow> proof(state) | local_theory | theory"} \\ |
|
579 @{command_def "by"} & : & @{text "proof(prove) \<rightarrow> proof(state) | local_theory | theory"} \\ |
|
580 @{command_def ".."} & : & @{text "proof(prove) \<rightarrow> proof(state) | local_theory | theory"} \\ |
|
581 @{command_def "."} & : & @{text "proof(prove) \<rightarrow> proof(state) | local_theory | theory"} \\ |
|
582 @{command_def "sorry"} & : & @{text "proof(prove) \<rightarrow> proof(state) | local_theory | theory"} \\ |
|
583 \end{matharray} |
|
584 |
|
585 Arbitrary goal refinement via tactics is considered harmful. |
|
586 Structured proof composition in Isar admits proof methods to be |
|
587 invoked in two places only. |
|
588 |
|
589 \begin{enumerate} |
|
590 |
|
591 \item An \emph{initial} refinement step @{command_ref |
|
592 "proof"}~@{text "m\<^sub>1"} reduces a newly stated goal to a number |
|
593 of sub-goals that are to be solved later. Facts are passed to |
|
594 @{text "m\<^sub>1"} for forward chaining, if so indicated by @{text |
|
595 "proof(chain)"} mode. |
|
596 |
|
597 \item A \emph{terminal} conclusion step @{command_ref "qed"}~@{text |
|
598 "m\<^sub>2"} is intended to solve remaining goals. No facts are |
|
599 passed to @{text "m\<^sub>2"}. |
|
600 |
|
601 \end{enumerate} |
|
602 |
|
603 The only other (proper) way to affect pending goals in a proof body |
|
604 is by @{command_ref "show"}, which involves an explicit statement of |
|
605 what is to be solved eventually. Thus we avoid the fundamental |
|
606 problem of unstructured tactic scripts that consist of numerous |
|
607 consecutive goal transformations, with invisible effects. |
|
608 |
|
609 \medskip As a general rule of thumb for good proof style, initial |
|
610 proof methods should either solve the goal completely, or constitute |
|
611 some well-understood reduction to new sub-goals. Arbitrary |
|
612 automatic proof tools that are prone leave a large number of badly |
|
613 structured sub-goals are no help in continuing the proof document in |
|
614 an intelligible manner. |
|
615 |
|
616 Unless given explicitly by the user, the default initial method is |
|
617 @{method_ref (Pure) rule} (or its classical variant @{method_ref |
|
618 rule}), which applies a single standard elimination or introduction |
|
619 rule according to the topmost symbol involved. There is no separate |
|
620 default terminal method. Any remaining goals are always solved by |
|
621 assumption in the very last step. |
|
622 |
|
623 @{rail " |
|
624 @@{command proof} method? |
|
625 ; |
|
626 @@{command qed} method? |
|
627 ; |
|
628 @@{command \"by\"} method method? |
|
629 ; |
|
630 (@@{command \".\"} | @@{command \"..\"} | @@{command sorry}) |
|
631 "} |
|
632 |
|
633 \begin{description} |
|
634 |
|
635 \item @{command "proof"}~@{text "m\<^sub>1"} refines the goal by proof |
|
636 method @{text "m\<^sub>1"}; facts for forward chaining are passed if so |
|
637 indicated by @{text "proof(chain)"} mode. |
|
638 |
|
639 \item @{command "qed"}~@{text "m\<^sub>2"} refines any remaining goals by |
|
640 proof method @{text "m\<^sub>2"} and concludes the sub-proof by assumption. |
|
641 If the goal had been @{text "show"} (or @{text "thus"}), some |
|
642 pending sub-goal is solved as well by the rule resulting from the |
|
643 result \emph{exported} into the enclosing goal context. Thus @{text |
|
644 "qed"} may fail for two reasons: either @{text "m\<^sub>2"} fails, or the |
|
645 resulting rule does not fit to any pending goal\footnote{This |
|
646 includes any additional ``strong'' assumptions as introduced by |
|
647 @{command "assume"}.} of the enclosing context. Debugging such a |
|
648 situation might involve temporarily changing @{command "show"} into |
|
649 @{command "have"}, or weakening the local context by replacing |
|
650 occurrences of @{command "assume"} by @{command "presume"}. |
|
651 |
|
652 \item @{command "by"}~@{text "m\<^sub>1 m\<^sub>2"} is a \emph{terminal |
|
653 proof}\index{proof!terminal}; it abbreviates @{command |
|
654 "proof"}~@{text "m\<^sub>1"}~@{command "qed"}~@{text "m\<^sub>2"}, but with |
|
655 backtracking across both methods. Debugging an unsuccessful |
|
656 @{command "by"}~@{text "m\<^sub>1 m\<^sub>2"} command can be done by expanding its |
|
657 definition; in many cases @{command "proof"}~@{text "m\<^sub>1"} (or even |
|
658 @{text "apply"}~@{text "m\<^sub>1"}) is already sufficient to see the |
|
659 problem. |
|
660 |
|
661 \item ``@{command ".."}'' is a \emph{default |
|
662 proof}\index{proof!default}; it abbreviates @{command "by"}~@{text |
|
663 "rule"}. |
|
664 |
|
665 \item ``@{command "."}'' is a \emph{trivial |
|
666 proof}\index{proof!trivial}; it abbreviates @{command "by"}~@{text |
|
667 "this"}. |
|
668 |
|
669 \item @{command "sorry"} is a \emph{fake proof}\index{proof!fake} |
|
670 pretending to solve the pending claim without further ado. This |
|
671 only works in interactive development, or if the @{ML |
|
672 quick_and_dirty} flag is enabled (in ML). Facts emerging from fake |
|
673 proofs are not the real thing. Internally, each theorem container |
|
674 is tainted by an oracle invocation, which is indicated as ``@{text |
|
675 "[!]"}'' in the printed result. |
|
676 |
|
677 The most important application of @{command "sorry"} is to support |
|
678 experimentation and top-down proof development. |
|
679 |
|
680 \end{description} |
|
681 *} |
|
682 |
|
683 |
|
684 subsection {* Fundamental methods and attributes \label{sec:pure-meth-att} *} |
|
685 |
|
686 text {* |
|
687 The following proof methods and attributes refer to basic logical |
|
688 operations of Isar. Further methods and attributes are provided by |
|
689 several generic and object-logic specific tools and packages (see |
|
690 \chref{ch:gen-tools} and \chref{ch:hol}). |
|
691 |
|
692 \begin{matharray}{rcl} |
|
693 @{method_def "-"} & : & @{text method} \\ |
|
694 @{method_def "fact"} & : & @{text method} \\ |
|
695 @{method_def "assumption"} & : & @{text method} \\ |
|
696 @{method_def "this"} & : & @{text method} \\ |
|
697 @{method_def (Pure) "rule"} & : & @{text method} \\ |
|
698 @{attribute_def (Pure) "intro"} & : & @{text attribute} \\ |
|
699 @{attribute_def (Pure) "elim"} & : & @{text attribute} \\ |
|
700 @{attribute_def (Pure) "dest"} & : & @{text attribute} \\ |
|
701 @{attribute_def (Pure) "rule"} & : & @{text attribute} \\[0.5ex] |
|
702 @{attribute_def "OF"} & : & @{text attribute} \\ |
|
703 @{attribute_def "of"} & : & @{text attribute} \\ |
|
704 @{attribute_def "where"} & : & @{text attribute} \\ |
|
705 \end{matharray} |
|
706 |
|
707 @{rail " |
|
708 @@{method fact} @{syntax thmrefs}? |
|
709 ; |
|
710 @@{method (Pure) rule} @{syntax thmrefs}? |
|
711 ; |
|
712 rulemod: ('intro' | 'elim' | 'dest') |
|
713 ((('!' | () | '?') @{syntax nat}?) | 'del') ':' @{syntax thmrefs} |
|
714 ; |
|
715 (@@{attribute intro} | @@{attribute elim} | @@{attribute dest}) |
|
716 ('!' | () | '?') @{syntax nat}? |
|
717 ; |
|
718 @@{attribute (Pure) rule} 'del' |
|
719 ; |
|
720 @@{attribute OF} @{syntax thmrefs} |
|
721 ; |
|
722 @@{attribute of} @{syntax insts} ('concl' ':' @{syntax insts})? |
|
723 ; |
|
724 @@{attribute \"where\"} |
|
725 ((@{syntax name} | @{syntax var} | @{syntax typefree} | @{syntax typevar}) '=' |
|
726 (@{syntax type} | @{syntax term}) * @'and') |
|
727 "} |
|
728 |
|
729 \begin{description} |
|
730 |
|
731 \item ``@{method "-"}'' (minus) does nothing but insert the forward |
|
732 chaining facts as premises into the goal. Note that command |
|
733 @{command_ref "proof"} without any method actually performs a single |
|
734 reduction step using the @{method_ref (Pure) rule} method; thus a plain |
|
735 \emph{do-nothing} proof step would be ``@{command "proof"}~@{text |
|
736 "-"}'' rather than @{command "proof"} alone. |
|
737 |
|
738 \item @{method "fact"}~@{text "a\<^sub>1 \<dots> a\<^sub>n"} composes some fact from |
|
739 @{text "a\<^sub>1, \<dots>, a\<^sub>n"} (or implicitly from the current proof context) |
|
740 modulo unification of schematic type and term variables. The rule |
|
741 structure is not taken into account, i.e.\ meta-level implication is |
|
742 considered atomic. This is the same principle underlying literal |
|
743 facts (cf.\ \secref{sec:syn-att}): ``@{command "have"}~@{text |
|
744 "\<phi>"}~@{command "by"}~@{text fact}'' is equivalent to ``@{command |
|
745 "note"}~@{verbatim "`"}@{text \<phi>}@{verbatim "`"}'' provided that |
|
746 @{text "\<turnstile> \<phi>"} is an instance of some known @{text "\<turnstile> \<phi>"} in the |
|
747 proof context. |
|
748 |
|
749 \item @{method assumption} solves some goal by a single assumption |
|
750 step. All given facts are guaranteed to participate in the |
|
751 refinement; this means there may be only 0 or 1 in the first place. |
|
752 Recall that @{command "qed"} (\secref{sec:proof-steps}) already |
|
753 concludes any remaining sub-goals by assumption, so structured |
|
754 proofs usually need not quote the @{method assumption} method at |
|
755 all. |
|
756 |
|
757 \item @{method this} applies all of the current facts directly as |
|
758 rules. Recall that ``@{command "."}'' (dot) abbreviates ``@{command |
|
759 "by"}~@{text this}''. |
|
760 |
|
761 \item @{method (Pure) rule}~@{text "a\<^sub>1 \<dots> a\<^sub>n"} applies some rule given as |
|
762 argument in backward manner; facts are used to reduce the rule |
|
763 before applying it to the goal. Thus @{method (Pure) rule} without facts |
|
764 is plain introduction, while with facts it becomes elimination. |
|
765 |
|
766 When no arguments are given, the @{method (Pure) rule} method tries to pick |
|
767 appropriate rules automatically, as declared in the current context |
|
768 using the @{attribute (Pure) intro}, @{attribute (Pure) elim}, |
|
769 @{attribute (Pure) dest} attributes (see below). This is the |
|
770 default behavior of @{command "proof"} and ``@{command ".."}'' |
|
771 (double-dot) steps (see \secref{sec:proof-steps}). |
|
772 |
|
773 \item @{attribute (Pure) intro}, @{attribute (Pure) elim}, and |
|
774 @{attribute (Pure) dest} declare introduction, elimination, and |
|
775 destruct rules, to be used with method @{method (Pure) rule}, and similar |
|
776 tools. Note that the latter will ignore rules declared with |
|
777 ``@{text "?"}'', while ``@{text "!"}'' are used most aggressively. |
|
778 |
|
779 The classical reasoner (see \secref{sec:classical}) introduces its |
|
780 own variants of these attributes; use qualified names to access the |
|
781 present versions of Isabelle/Pure, i.e.\ @{attribute (Pure) |
|
782 "Pure.intro"}. |
|
783 |
|
784 \item @{attribute (Pure) rule}~@{text del} undeclares introduction, |
|
785 elimination, or destruct rules. |
|
786 |
|
787 \item @{attribute OF}~@{text "a\<^sub>1 \<dots> a\<^sub>n"} applies some theorem to all |
|
788 of the given rules @{text "a\<^sub>1, \<dots>, a\<^sub>n"} in canonical right-to-left |
|
789 order, which means that premises stemming from the @{text "a\<^sub>i"} |
|
790 emerge in parallel in the result, without interfering with each |
|
791 other. In many practical situations, the @{text "a\<^sub>i"} do not have |
|
792 premises themselves, so @{text "rule [OF a\<^sub>1 \<dots> a\<^sub>n]"} can be actually |
|
793 read as functional application (modulo unification). |
|
794 |
|
795 Argument positions may be effectively skipped by using ``@{text _}'' |
|
796 (underscore), which refers to the propositional identity rule in the |
|
797 Pure theory. |
|
798 |
|
799 \item @{attribute of}~@{text "t\<^sub>1 \<dots> t\<^sub>n"} performs positional |
|
800 instantiation of term variables. The terms @{text "t\<^sub>1, \<dots>, t\<^sub>n"} are |
|
801 substituted for any schematic variables occurring in a theorem from |
|
802 left to right; ``@{text _}'' (underscore) indicates to skip a |
|
803 position. Arguments following a ``@{text "concl:"}'' specification |
|
804 refer to positions of the conclusion of a rule. |
|
805 |
|
806 \item @{attribute "where"}~@{text "x\<^sub>1 = t\<^sub>1 \<AND> \<dots> x\<^sub>n = t\<^sub>n"} |
|
807 performs named instantiation of schematic type and term variables |
|
808 occurring in a theorem. Schematic variables have to be specified on |
|
809 the left-hand side (e.g.\ @{text "?x1.3"}). The question mark may |
|
810 be omitted if the variable name is a plain identifier without index. |
|
811 As type instantiations are inferred from term instantiations, |
|
812 explicit type instantiations are seldom necessary. |
|
813 |
|
814 \end{description} |
|
815 *} |
|
816 |
|
817 |
|
818 subsection {* Emulating tactic scripts \label{sec:tactic-commands} *} |
|
819 |
|
820 text {* |
|
821 The Isar provides separate commands to accommodate tactic-style |
|
822 proof scripts within the same system. While being outside the |
|
823 orthodox Isar proof language, these might come in handy for |
|
824 interactive exploration and debugging, or even actual tactical proof |
|
825 within new-style theories (to benefit from document preparation, for |
|
826 example). See also \secref{sec:tactics} for actual tactics, that |
|
827 have been encapsulated as proof methods. Proper proof methods may |
|
828 be used in scripts, too. |
|
829 |
|
830 \begin{matharray}{rcl} |
|
831 @{command_def "apply"}@{text "\<^sup>*"} & : & @{text "proof(prove) \<rightarrow> proof(prove)"} \\ |
|
832 @{command_def "apply_end"}@{text "\<^sup>*"} & : & @{text "proof(state) \<rightarrow> proof(state)"} \\ |
|
833 @{command_def "done"}@{text "\<^sup>*"} & : & @{text "proof(prove) \<rightarrow> proof(state) | local_theory | theory"} \\ |
|
834 @{command_def "defer"}@{text "\<^sup>*"} & : & @{text "proof \<rightarrow> proof"} \\ |
|
835 @{command_def "prefer"}@{text "\<^sup>*"} & : & @{text "proof \<rightarrow> proof"} \\ |
|
836 @{command_def "back"}@{text "\<^sup>*"} & : & @{text "proof \<rightarrow> proof"} \\ |
|
837 \end{matharray} |
|
838 |
|
839 @{rail " |
|
840 ( @@{command apply} | @@{command apply_end} ) @{syntax method} |
|
841 ; |
|
842 @@{command defer} @{syntax nat}? |
|
843 ; |
|
844 @@{command prefer} @{syntax nat} |
|
845 "} |
|
846 |
|
847 \begin{description} |
|
848 |
|
849 \item @{command "apply"}~@{text m} applies proof method @{text m} in |
|
850 initial position, but unlike @{command "proof"} it retains ``@{text |
|
851 "proof(prove)"}'' mode. Thus consecutive method applications may be |
|
852 given just as in tactic scripts. |
|
853 |
|
854 Facts are passed to @{text m} as indicated by the goal's |
|
855 forward-chain mode, and are \emph{consumed} afterwards. Thus any |
|
856 further @{command "apply"} command would always work in a purely |
|
857 backward manner. |
|
858 |
|
859 \item @{command "apply_end"}~@{text "m"} applies proof method @{text |
|
860 m} as if in terminal position. Basically, this simulates a |
|
861 multi-step tactic script for @{command "qed"}, but may be given |
|
862 anywhere within the proof body. |
|
863 |
|
864 No facts are passed to @{text m} here. Furthermore, the static |
|
865 context is that of the enclosing goal (as for actual @{command |
|
866 "qed"}). Thus the proof method may not refer to any assumptions |
|
867 introduced in the current body, for example. |
|
868 |
|
869 \item @{command "done"} completes a proof script, provided that the |
|
870 current goal state is solved completely. Note that actual |
|
871 structured proof commands (e.g.\ ``@{command "."}'' or @{command |
|
872 "sorry"}) may be used to conclude proof scripts as well. |
|
873 |
|
874 \item @{command "defer"}~@{text n} and @{command "prefer"}~@{text n} |
|
875 shuffle the list of pending goals: @{command "defer"} puts off |
|
876 sub-goal @{text n} to the end of the list (@{text "n = 1"} by |
|
877 default), while @{command "prefer"} brings sub-goal @{text n} to the |
|
878 front. |
|
879 |
|
880 \item @{command "back"} does back-tracking over the result sequence |
|
881 of the latest proof command. Basically, any proof command may |
|
882 return multiple results. |
|
883 |
|
884 \end{description} |
|
885 |
|
886 Any proper Isar proof method may be used with tactic script commands |
|
887 such as @{command "apply"}. A few additional emulations of actual |
|
888 tactics are provided as well; these would be never used in actual |
|
889 structured proofs, of course. |
|
890 *} |
|
891 |
|
892 |
|
893 subsection {* Defining proof methods *} |
|
894 |
|
895 text {* |
|
896 \begin{matharray}{rcl} |
|
897 @{command_def "method_setup"} & : & @{text "theory \<rightarrow> theory"} \\ |
|
898 \end{matharray} |
|
899 |
|
900 @{rail " |
|
901 @@{command method_setup} @{syntax name} '=' @{syntax text} @{syntax text}? |
|
902 ; |
|
903 "} |
|
904 |
|
905 \begin{description} |
|
906 |
|
907 \item @{command "method_setup"}~@{text "name = text description"} |
|
908 defines a proof method in the current theory. The given @{text |
|
909 "text"} has to be an ML expression of type |
|
910 @{ML_type "(Proof.context -> Proof.method) context_parser"}, cf.\ |
|
911 basic parsers defined in structure @{ML_struct Args} and @{ML_struct |
|
912 Attrib}. There are also combinators like @{ML METHOD} and @{ML |
|
913 SIMPLE_METHOD} to turn certain tactic forms into official proof |
|
914 methods; the primed versions refer to tactics with explicit goal |
|
915 addressing. |
|
916 |
|
917 Here are some example method definitions: |
|
918 |
|
919 \end{description} |
|
920 *} |
|
921 |
|
922 method_setup my_method1 = {* |
|
923 Scan.succeed (K (SIMPLE_METHOD' (fn i: int => no_tac))) |
|
924 *} "my first method (without any arguments)" |
|
925 |
|
926 method_setup my_method2 = {* |
|
927 Scan.succeed (fn ctxt: Proof.context => |
|
928 SIMPLE_METHOD' (fn i: int => no_tac)) |
|
929 *} "my second method (with context)" |
|
930 |
|
931 method_setup my_method3 = {* |
|
932 Attrib.thms >> (fn thms: thm list => fn ctxt: Proof.context => |
|
933 SIMPLE_METHOD' (fn i: int => no_tac)) |
|
934 *} "my third method (with theorem arguments and context)" |
|
935 |
|
936 |
|
937 section {* Generalized elimination \label{sec:obtain} *} |
|
938 |
|
939 text {* |
|
940 \begin{matharray}{rcl} |
|
941 @{command_def "obtain"} & : & @{text "proof(state) | proof(chain) \<rightarrow> proof(prove)"} \\ |
|
942 @{command_def "guess"}@{text "\<^sup>*"} & : & @{text "proof(state) | proof(chain) \<rightarrow> proof(prove)"} \\ |
|
943 \end{matharray} |
|
944 |
|
945 Generalized elimination means that additional elements with certain |
|
946 properties may be introduced in the current context, by virtue of a |
|
947 locally proven ``soundness statement''. Technically speaking, the |
|
948 @{command "obtain"} language element is like a declaration of |
|
949 @{command "fix"} and @{command "assume"} (see also see |
|
950 \secref{sec:proof-context}), together with a soundness proof of its |
|
951 additional claim. According to the nature of existential reasoning, |
|
952 assumptions get eliminated from any result exported from the context |
|
953 later, provided that the corresponding parameters do \emph{not} |
|
954 occur in the conclusion. |
|
955 |
|
956 @{rail " |
|
957 @@{command obtain} @{syntax parname}? (@{syntax vars} + @'and') |
|
958 @'where' (@{syntax props} + @'and') |
|
959 ; |
|
960 @@{command guess} (@{syntax vars} + @'and') |
|
961 "} |
|
962 |
|
963 The derived Isar command @{command "obtain"} is defined as follows |
|
964 (where @{text "b\<^sub>1, \<dots>, b\<^sub>k"} shall refer to (optional) |
|
965 facts indicated for forward chaining). |
|
966 \begin{matharray}{l} |
|
967 @{text "\<langle>using b\<^sub>1 \<dots> b\<^sub>k\<rangle>"}~~@{command "obtain"}~@{text "x\<^sub>1 \<dots> x\<^sub>m \<WHERE> a: \<phi>\<^sub>1 \<dots> \<phi>\<^sub>n \<langle>proof\<rangle> \<equiv>"} \\[1ex] |
|
968 \quad @{command "have"}~@{text "\<And>thesis. (\<And>x\<^sub>1 \<dots> x\<^sub>m. \<phi>\<^sub>1 \<Longrightarrow> \<dots> \<phi>\<^sub>n \<Longrightarrow> thesis) \<Longrightarrow> thesis"} \\ |
|
969 \quad @{command "proof"}~@{method succeed} \\ |
|
970 \qquad @{command "fix"}~@{text thesis} \\ |
|
971 \qquad @{command "assume"}~@{text "that [Pure.intro?]: \<And>x\<^sub>1 \<dots> x\<^sub>m. \<phi>\<^sub>1 \<Longrightarrow> \<dots> \<phi>\<^sub>n \<Longrightarrow> thesis"} \\ |
|
972 \qquad @{command "then"}~@{command "show"}~@{text thesis} \\ |
|
973 \quad\qquad @{command "apply"}~@{text -} \\ |
|
974 \quad\qquad @{command "using"}~@{text "b\<^sub>1 \<dots> b\<^sub>k \<langle>proof\<rangle>"} \\ |
|
975 \quad @{command "qed"} \\ |
|
976 \quad @{command "fix"}~@{text "x\<^sub>1 \<dots> x\<^sub>m"}~@{command "assume"}@{text "\<^sup>* a: \<phi>\<^sub>1 \<dots> \<phi>\<^sub>n"} \\ |
|
977 \end{matharray} |
|
978 |
|
979 Typically, the soundness proof is relatively straight-forward, often |
|
980 just by canonical automated tools such as ``@{command "by"}~@{text |
|
981 simp}'' or ``@{command "by"}~@{text blast}''. Accordingly, the |
|
982 ``@{text that}'' reduction above is declared as simplification and |
|
983 introduction rule. |
|
984 |
|
985 In a sense, @{command "obtain"} represents at the level of Isar |
|
986 proofs what would be meta-logical existential quantifiers and |
|
987 conjunctions. This concept has a broad range of useful |
|
988 applications, ranging from plain elimination (or introduction) of |
|
989 object-level existential and conjunctions, to elimination over |
|
990 results of symbolic evaluation of recursive definitions, for |
|
991 example. Also note that @{command "obtain"} without parameters acts |
|
992 much like @{command "have"}, where the result is treated as a |
|
993 genuine assumption. |
|
994 |
|
995 An alternative name to be used instead of ``@{text that}'' above may |
|
996 be given in parentheses. |
|
997 |
|
998 \medskip The improper variant @{command "guess"} is similar to |
|
999 @{command "obtain"}, but derives the obtained statement from the |
|
1000 course of reasoning! The proof starts with a fixed goal @{text |
|
1001 thesis}. The subsequent proof may refine this to anything of the |
|
1002 form like @{text "\<And>x\<^sub>1 \<dots> x\<^sub>m. \<phi>\<^sub>1 \<Longrightarrow> \<dots> |
|
1003 \<phi>\<^sub>n \<Longrightarrow> thesis"}, but must not introduce new subgoals. The |
|
1004 final goal state is then used as reduction rule for the obtain |
|
1005 scheme described above. Obtained parameters @{text "x\<^sub>1, \<dots>, |
|
1006 x\<^sub>m"} are marked as internal by default, which prevents the |
|
1007 proof context from being polluted by ad-hoc variables. The variable |
|
1008 names and type constraints given as arguments for @{command "guess"} |
|
1009 specify a prefix of obtained parameters explicitly in the text. |
|
1010 |
|
1011 It is important to note that the facts introduced by @{command |
|
1012 "obtain"} and @{command "guess"} may not be polymorphic: any |
|
1013 type-variables occurring here are fixed in the present context! |
|
1014 *} |
|
1015 |
|
1016 |
|
1017 section {* Calculational reasoning \label{sec:calculation} *} |
|
1018 |
|
1019 text {* |
|
1020 \begin{matharray}{rcl} |
|
1021 @{command_def "also"} & : & @{text "proof(state) \<rightarrow> proof(state)"} \\ |
|
1022 @{command_def "finally"} & : & @{text "proof(state) \<rightarrow> proof(chain)"} \\ |
|
1023 @{command_def "moreover"} & : & @{text "proof(state) \<rightarrow> proof(state)"} \\ |
|
1024 @{command_def "ultimately"} & : & @{text "proof(state) \<rightarrow> proof(chain)"} \\ |
|
1025 @{command_def "print_trans_rules"}@{text "\<^sup>*"} & : & @{text "context \<rightarrow>"} \\ |
|
1026 @{attribute trans} & : & @{text attribute} \\ |
|
1027 @{attribute sym} & : & @{text attribute} \\ |
|
1028 @{attribute symmetric} & : & @{text attribute} \\ |
|
1029 \end{matharray} |
|
1030 |
|
1031 Calculational proof is forward reasoning with implicit application |
|
1032 of transitivity rules (such those of @{text "="}, @{text "\<le>"}, |
|
1033 @{text "<"}). Isabelle/Isar maintains an auxiliary fact register |
|
1034 @{fact_ref calculation} for accumulating results obtained by |
|
1035 transitivity composed with the current result. Command @{command |
|
1036 "also"} updates @{fact calculation} involving @{fact this}, while |
|
1037 @{command "finally"} exhibits the final @{fact calculation} by |
|
1038 forward chaining towards the next goal statement. Both commands |
|
1039 require valid current facts, i.e.\ may occur only after commands |
|
1040 that produce theorems such as @{command "assume"}, @{command |
|
1041 "note"}, or some finished proof of @{command "have"}, @{command |
|
1042 "show"} etc. The @{command "moreover"} and @{command "ultimately"} |
|
1043 commands are similar to @{command "also"} and @{command "finally"}, |
|
1044 but only collect further results in @{fact calculation} without |
|
1045 applying any rules yet. |
|
1046 |
|
1047 Also note that the implicit term abbreviation ``@{text "\<dots>"}'' has |
|
1048 its canonical application with calculational proofs. It refers to |
|
1049 the argument of the preceding statement. (The argument of a curried |
|
1050 infix expression happens to be its right-hand side.) |
|
1051 |
|
1052 Isabelle/Isar calculations are implicitly subject to block structure |
|
1053 in the sense that new threads of calculational reasoning are |
|
1054 commenced for any new block (as opened by a local goal, for |
|
1055 example). This means that, apart from being able to nest |
|
1056 calculations, there is no separate \emph{begin-calculation} command |
|
1057 required. |
|
1058 |
|
1059 \medskip The Isar calculation proof commands may be defined as |
|
1060 follows:\footnote{We suppress internal bookkeeping such as proper |
|
1061 handling of block-structure.} |
|
1062 |
|
1063 \begin{matharray}{rcl} |
|
1064 @{command "also"}@{text "\<^sub>0"} & \equiv & @{command "note"}~@{text "calculation = this"} \\ |
|
1065 @{command "also"}@{text "\<^sub>n+1"} & \equiv & @{command "note"}~@{text "calculation = trans [OF calculation this]"} \\[0.5ex] |
|
1066 @{command "finally"} & \equiv & @{command "also"}~@{command "from"}~@{text calculation} \\[0.5ex] |
|
1067 @{command "moreover"} & \equiv & @{command "note"}~@{text "calculation = calculation this"} \\ |
|
1068 @{command "ultimately"} & \equiv & @{command "moreover"}~@{command "from"}~@{text calculation} \\ |
|
1069 \end{matharray} |
|
1070 |
|
1071 @{rail " |
|
1072 (@@{command also} | @@{command finally}) ('(' @{syntax thmrefs} ')')? |
|
1073 ; |
|
1074 @@{attribute trans} (() | 'add' | 'del') |
|
1075 "} |
|
1076 |
|
1077 \begin{description} |
|
1078 |
|
1079 \item @{command "also"}~@{text "(a\<^sub>1 \<dots> a\<^sub>n)"} maintains the auxiliary |
|
1080 @{fact calculation} register as follows. The first occurrence of |
|
1081 @{command "also"} in some calculational thread initializes @{fact |
|
1082 calculation} by @{fact this}. Any subsequent @{command "also"} on |
|
1083 the same level of block-structure updates @{fact calculation} by |
|
1084 some transitivity rule applied to @{fact calculation} and @{fact |
|
1085 this} (in that order). Transitivity rules are picked from the |
|
1086 current context, unless alternative rules are given as explicit |
|
1087 arguments. |
|
1088 |
|
1089 \item @{command "finally"}~@{text "(a\<^sub>1 \<dots> a\<^sub>n)"} maintaining @{fact |
|
1090 calculation} in the same way as @{command "also"}, and concludes the |
|
1091 current calculational thread. The final result is exhibited as fact |
|
1092 for forward chaining towards the next goal. Basically, @{command |
|
1093 "finally"} just abbreviates @{command "also"}~@{command |
|
1094 "from"}~@{fact calculation}. Typical idioms for concluding |
|
1095 calculational proofs are ``@{command "finally"}~@{command |
|
1096 "show"}~@{text ?thesis}~@{command "."}'' and ``@{command |
|
1097 "finally"}~@{command "have"}~@{text \<phi>}~@{command "."}''. |
|
1098 |
|
1099 \item @{command "moreover"} and @{command "ultimately"} are |
|
1100 analogous to @{command "also"} and @{command "finally"}, but collect |
|
1101 results only, without applying rules. |
|
1102 |
|
1103 \item @{command "print_trans_rules"} prints the list of transitivity |
|
1104 rules (for calculational commands @{command "also"} and @{command |
|
1105 "finally"}) and symmetry rules (for the @{attribute symmetric} |
|
1106 operation and single step elimination patters) of the current |
|
1107 context. |
|
1108 |
|
1109 \item @{attribute trans} declares theorems as transitivity rules. |
|
1110 |
|
1111 \item @{attribute sym} declares symmetry rules, as well as |
|
1112 @{attribute "Pure.elim"}@{text "?"} rules. |
|
1113 |
|
1114 \item @{attribute symmetric} resolves a theorem with some rule |
|
1115 declared as @{attribute sym} in the current context. For example, |
|
1116 ``@{command "assume"}~@{text "[symmetric]: x = y"}'' produces a |
|
1117 swapped fact derived from that assumption. |
|
1118 |
|
1119 In structured proof texts it is often more appropriate to use an |
|
1120 explicit single-step elimination proof, such as ``@{command |
|
1121 "assume"}~@{text "x = y"}~@{command "then"}~@{command "have"}~@{text |
|
1122 "y = x"}~@{command ".."}''. |
|
1123 |
|
1124 \end{description} |
|
1125 *} |
|
1126 |
|
1127 |
|
1128 section {* Proof by cases and induction \label{sec:cases-induct} *} |
|
1129 |
|
1130 subsection {* Rule contexts *} |
|
1131 |
|
1132 text {* |
|
1133 \begin{matharray}{rcl} |
|
1134 @{command_def "case"} & : & @{text "proof(state) \<rightarrow> proof(state)"} \\ |
|
1135 @{command_def "print_cases"}@{text "\<^sup>*"} & : & @{text "context \<rightarrow>"} \\ |
|
1136 @{attribute_def case_names} & : & @{text attribute} \\ |
|
1137 @{attribute_def case_conclusion} & : & @{text attribute} \\ |
|
1138 @{attribute_def params} & : & @{text attribute} \\ |
|
1139 @{attribute_def consumes} & : & @{text attribute} \\ |
|
1140 \end{matharray} |
|
1141 |
|
1142 The puristic way to build up Isar proof contexts is by explicit |
|
1143 language elements like @{command "fix"}, @{command "assume"}, |
|
1144 @{command "let"} (see \secref{sec:proof-context}). This is adequate |
|
1145 for plain natural deduction, but easily becomes unwieldy in concrete |
|
1146 verification tasks, which typically involve big induction rules with |
|
1147 several cases. |
|
1148 |
|
1149 The @{command "case"} command provides a shorthand to refer to a |
|
1150 local context symbolically: certain proof methods provide an |
|
1151 environment of named ``cases'' of the form @{text "c: x\<^sub>1, \<dots>, |
|
1152 x\<^sub>m, \<phi>\<^sub>1, \<dots>, \<phi>\<^sub>n"}; the effect of ``@{command |
|
1153 "case"}~@{text c}'' is then equivalent to ``@{command "fix"}~@{text |
|
1154 "x\<^sub>1 \<dots> x\<^sub>m"}~@{command "assume"}~@{text "c: \<phi>\<^sub>1 \<dots> |
|
1155 \<phi>\<^sub>n"}''. Term bindings may be covered as well, notably |
|
1156 @{variable ?case} for the main conclusion. |
|
1157 |
|
1158 By default, the ``terminology'' @{text "x\<^sub>1, \<dots>, x\<^sub>m"} of |
|
1159 a case value is marked as hidden, i.e.\ there is no way to refer to |
|
1160 such parameters in the subsequent proof text. After all, original |
|
1161 rule parameters stem from somewhere outside of the current proof |
|
1162 text. By using the explicit form ``@{command "case"}~@{text "(c |
|
1163 y\<^sub>1 \<dots> y\<^sub>m)"}'' instead, the proof author is able to |
|
1164 chose local names that fit nicely into the current context. |
|
1165 |
|
1166 \medskip It is important to note that proper use of @{command |
|
1167 "case"} does not provide means to peek at the current goal state, |
|
1168 which is not directly observable in Isar! Nonetheless, goal |
|
1169 refinement commands do provide named cases @{text "goal\<^sub>i"} |
|
1170 for each subgoal @{text "i = 1, \<dots>, n"} of the resulting goal state. |
|
1171 Using this extra feature requires great care, because some bits of |
|
1172 the internal tactical machinery intrude the proof text. In |
|
1173 particular, parameter names stemming from the left-over of automated |
|
1174 reasoning tools are usually quite unpredictable. |
|
1175 |
|
1176 Under normal circumstances, the text of cases emerge from standard |
|
1177 elimination or induction rules, which in turn are derived from |
|
1178 previous theory specifications in a canonical way (say from |
|
1179 @{command "inductive"} definitions). |
|
1180 |
|
1181 \medskip Proper cases are only available if both the proof method |
|
1182 and the rules involved support this. By using appropriate |
|
1183 attributes, case names, conclusions, and parameters may be also |
|
1184 declared by hand. Thus variant versions of rules that have been |
|
1185 derived manually become ready to use in advanced case analysis |
|
1186 later. |
|
1187 |
|
1188 @{rail " |
|
1189 @@{command case} (caseref | '(' caseref (('_' | @{syntax name}) +) ')') |
|
1190 ; |
|
1191 caseref: nameref attributes? |
|
1192 ; |
|
1193 |
|
1194 @@{attribute case_names} ((@{syntax name} ( '[' (('_' | @{syntax name}) +) ']' ) ? ) +) |
|
1195 ; |
|
1196 @@{attribute case_conclusion} @{syntax name} (@{syntax name} * ) |
|
1197 ; |
|
1198 @@{attribute params} ((@{syntax name} * ) + @'and') |
|
1199 ; |
|
1200 @@{attribute consumes} @{syntax nat}? |
|
1201 "} |
|
1202 |
|
1203 \begin{description} |
|
1204 |
|
1205 \item @{command "case"}~@{text "(c x\<^sub>1 \<dots> x\<^sub>m)"} invokes a named local |
|
1206 context @{text "c: x\<^sub>1, \<dots>, x\<^sub>m, \<phi>\<^sub>1, \<dots>, \<phi>\<^sub>m"}, as provided by an |
|
1207 appropriate proof method (such as @{method_ref cases} and |
|
1208 @{method_ref induct}). The command ``@{command "case"}~@{text "(c |
|
1209 x\<^sub>1 \<dots> x\<^sub>m)"}'' abbreviates ``@{command "fix"}~@{text "x\<^sub>1 \<dots> |
|
1210 x\<^sub>m"}~@{command "assume"}~@{text "c: \<phi>\<^sub>1 \<dots> \<phi>\<^sub>n"}''. |
|
1211 |
|
1212 \item @{command "print_cases"} prints all local contexts of the |
|
1213 current state, using Isar proof language notation. |
|
1214 |
|
1215 \item @{attribute case_names}~@{text "c\<^sub>1 \<dots> c\<^sub>k"} declares names for |
|
1216 the local contexts of premises of a theorem; @{text "c\<^sub>1, \<dots>, c\<^sub>k"} |
|
1217 refers to the \emph{prefix} of the list of premises. Each of the |
|
1218 cases @{text "c\<^isub>i"} can be of the form @{text "c[h\<^isub>1 \<dots> h\<^isub>n]"} where |
|
1219 the @{text "h\<^isub>1 \<dots> h\<^isub>n"} are the names of the hypotheses in case @{text "c\<^isub>i"} |
|
1220 from left to right. |
|
1221 |
|
1222 \item @{attribute case_conclusion}~@{text "c d\<^sub>1 \<dots> d\<^sub>k"} declares |
|
1223 names for the conclusions of a named premise @{text c}; here @{text |
|
1224 "d\<^sub>1, \<dots>, d\<^sub>k"} refers to the prefix of arguments of a logical formula |
|
1225 built by nesting a binary connective (e.g.\ @{text "\<or>"}). |
|
1226 |
|
1227 Note that proof methods such as @{method induct} and @{method |
|
1228 coinduct} already provide a default name for the conclusion as a |
|
1229 whole. The need to name subformulas only arises with cases that |
|
1230 split into several sub-cases, as in common co-induction rules. |
|
1231 |
|
1232 \item @{attribute params}~@{text "p\<^sub>1 \<dots> p\<^sub>m \<AND> \<dots> q\<^sub>1 \<dots> q\<^sub>n"} renames |
|
1233 the innermost parameters of premises @{text "1, \<dots>, n"} of some |
|
1234 theorem. An empty list of names may be given to skip positions, |
|
1235 leaving the present parameters unchanged. |
|
1236 |
|
1237 Note that the default usage of case rules does \emph{not} directly |
|
1238 expose parameters to the proof context. |
|
1239 |
|
1240 \item @{attribute consumes}~@{text n} declares the number of ``major |
|
1241 premises'' of a rule, i.e.\ the number of facts to be consumed when |
|
1242 it is applied by an appropriate proof method. The default value of |
|
1243 @{attribute consumes} is @{text "n = 1"}, which is appropriate for |
|
1244 the usual kind of cases and induction rules for inductive sets (cf.\ |
|
1245 \secref{sec:hol-inductive}). Rules without any @{attribute |
|
1246 consumes} declaration given are treated as if @{attribute |
|
1247 consumes}~@{text 0} had been specified. |
|
1248 |
|
1249 Note that explicit @{attribute consumes} declarations are only |
|
1250 rarely needed; this is already taken care of automatically by the |
|
1251 higher-level @{attribute cases}, @{attribute induct}, and |
|
1252 @{attribute coinduct} declarations. |
|
1253 |
|
1254 \end{description} |
|
1255 *} |
|
1256 |
|
1257 |
|
1258 subsection {* Proof methods *} |
|
1259 |
|
1260 text {* |
|
1261 \begin{matharray}{rcl} |
|
1262 @{method_def cases} & : & @{text method} \\ |
|
1263 @{method_def induct} & : & @{text method} \\ |
|
1264 @{method_def induction} & : & @{text method} \\ |
|
1265 @{method_def coinduct} & : & @{text method} \\ |
|
1266 \end{matharray} |
|
1267 |
|
1268 The @{method cases}, @{method induct}, @{method induction}, |
|
1269 and @{method coinduct} |
|
1270 methods provide a uniform interface to common proof techniques over |
|
1271 datatypes, inductive predicates (or sets), recursive functions etc. |
|
1272 The corresponding rules may be specified and instantiated in a |
|
1273 casual manner. Furthermore, these methods provide named local |
|
1274 contexts that may be invoked via the @{command "case"} proof command |
|
1275 within the subsequent proof text. This accommodates compact proof |
|
1276 texts even when reasoning about large specifications. |
|
1277 |
|
1278 The @{method induct} method also provides some additional |
|
1279 infrastructure in order to be applicable to structure statements |
|
1280 (either using explicit meta-level connectives, or including facts |
|
1281 and parameters separately). This avoids cumbersome encoding of |
|
1282 ``strengthened'' inductive statements within the object-logic. |
|
1283 |
|
1284 Method @{method induction} differs from @{method induct} only in |
|
1285 the names of the facts in the local context invoked by the @{command "case"} |
|
1286 command. |
|
1287 |
|
1288 @{rail " |
|
1289 @@{method cases} ('(' 'no_simp' ')')? \\ |
|
1290 (@{syntax insts} * @'and') rule? |
|
1291 ; |
|
1292 (@@{method induct} | @@{method induction}) ('(' 'no_simp' ')')? (definsts * @'and') \\ arbitrary? taking? rule? |
|
1293 ; |
|
1294 @@{method coinduct} @{syntax insts} taking rule? |
|
1295 ; |
|
1296 |
|
1297 rule: ('type' | 'pred' | 'set') ':' (@{syntax nameref} +) | 'rule' ':' (@{syntax thmref} +) |
|
1298 ; |
|
1299 definst: @{syntax name} ('==' | '\<equiv>') @{syntax term} | '(' @{syntax term} ')' | @{syntax inst} |
|
1300 ; |
|
1301 definsts: ( definst * ) |
|
1302 ; |
|
1303 arbitrary: 'arbitrary' ':' ((@{syntax term} * ) @'and' +) |
|
1304 ; |
|
1305 taking: 'taking' ':' @{syntax insts} |
|
1306 "} |
|
1307 |
|
1308 \begin{description} |
|
1309 |
|
1310 \item @{method cases}~@{text "insts R"} applies method @{method |
|
1311 rule} with an appropriate case distinction theorem, instantiated to |
|
1312 the subjects @{text insts}. Symbolic case names are bound according |
|
1313 to the rule's local contexts. |
|
1314 |
|
1315 The rule is determined as follows, according to the facts and |
|
1316 arguments passed to the @{method cases} method: |
|
1317 |
|
1318 \medskip |
|
1319 \begin{tabular}{llll} |
|
1320 facts & & arguments & rule \\\hline |
|
1321 & @{method cases} & & classical case split \\ |
|
1322 & @{method cases} & @{text t} & datatype exhaustion (type of @{text t}) \\ |
|
1323 @{text "\<turnstile> A t"} & @{method cases} & @{text "\<dots>"} & inductive predicate/set elimination (of @{text A}) \\ |
|
1324 @{text "\<dots>"} & @{method cases} & @{text "\<dots> rule: R"} & explicit rule @{text R} \\ |
|
1325 \end{tabular} |
|
1326 \medskip |
|
1327 |
|
1328 Several instantiations may be given, referring to the \emph{suffix} |
|
1329 of premises of the case rule; within each premise, the \emph{prefix} |
|
1330 of variables is instantiated. In most situations, only a single |
|
1331 term needs to be specified; this refers to the first variable of the |
|
1332 last premise (it is usually the same for all cases). The @{text |
|
1333 "(no_simp)"} option can be used to disable pre-simplification of |
|
1334 cases (see the description of @{method induct} below for details). |
|
1335 |
|
1336 \item @{method induct}~@{text "insts R"} and |
|
1337 @{method induction}~@{text "insts R"} are analogous to the |
|
1338 @{method cases} method, but refer to induction rules, which are |
|
1339 determined as follows: |
|
1340 |
|
1341 \medskip |
|
1342 \begin{tabular}{llll} |
|
1343 facts & & arguments & rule \\\hline |
|
1344 & @{method induct} & @{text "P x"} & datatype induction (type of @{text x}) \\ |
|
1345 @{text "\<turnstile> A x"} & @{method induct} & @{text "\<dots>"} & predicate/set induction (of @{text A}) \\ |
|
1346 @{text "\<dots>"} & @{method induct} & @{text "\<dots> rule: R"} & explicit rule @{text R} \\ |
|
1347 \end{tabular} |
|
1348 \medskip |
|
1349 |
|
1350 Several instantiations may be given, each referring to some part of |
|
1351 a mutual inductive definition or datatype --- only related partial |
|
1352 induction rules may be used together, though. Any of the lists of |
|
1353 terms @{text "P, x, \<dots>"} refers to the \emph{suffix} of variables |
|
1354 present in the induction rule. This enables the writer to specify |
|
1355 only induction variables, or both predicates and variables, for |
|
1356 example. |
|
1357 |
|
1358 Instantiations may be definitional: equations @{text "x \<equiv> t"} |
|
1359 introduce local definitions, which are inserted into the claim and |
|
1360 discharged after applying the induction rule. Equalities reappear |
|
1361 in the inductive cases, but have been transformed according to the |
|
1362 induction principle being involved here. In order to achieve |
|
1363 practically useful induction hypotheses, some variables occurring in |
|
1364 @{text t} need to be fixed (see below). Instantiations of the form |
|
1365 @{text t}, where @{text t} is not a variable, are taken as a |
|
1366 shorthand for \mbox{@{text "x \<equiv> t"}}, where @{text x} is a fresh |
|
1367 variable. If this is not intended, @{text t} has to be enclosed in |
|
1368 parentheses. By default, the equalities generated by definitional |
|
1369 instantiations are pre-simplified using a specific set of rules, |
|
1370 usually consisting of distinctness and injectivity theorems for |
|
1371 datatypes. This pre-simplification may cause some of the parameters |
|
1372 of an inductive case to disappear, or may even completely delete |
|
1373 some of the inductive cases, if one of the equalities occurring in |
|
1374 their premises can be simplified to @{text False}. The @{text |
|
1375 "(no_simp)"} option can be used to disable pre-simplification. |
|
1376 Additional rules to be used in pre-simplification can be declared |
|
1377 using the @{attribute_def induct_simp} attribute. |
|
1378 |
|
1379 The optional ``@{text "arbitrary: x\<^sub>1 \<dots> x\<^sub>m"}'' |
|
1380 specification generalizes variables @{text "x\<^sub>1, \<dots>, |
|
1381 x\<^sub>m"} of the original goal before applying induction. One can |
|
1382 separate variables by ``@{text "and"}'' to generalize them in other |
|
1383 goals then the first. Thus induction hypotheses may become |
|
1384 sufficiently general to get the proof through. Together with |
|
1385 definitional instantiations, one may effectively perform induction |
|
1386 over expressions of a certain structure. |
|
1387 |
|
1388 The optional ``@{text "taking: t\<^sub>1 \<dots> t\<^sub>n"}'' |
|
1389 specification provides additional instantiations of a prefix of |
|
1390 pending variables in the rule. Such schematic induction rules |
|
1391 rarely occur in practice, though. |
|
1392 |
|
1393 \item @{method coinduct}~@{text "inst R"} is analogous to the |
|
1394 @{method induct} method, but refers to coinduction rules, which are |
|
1395 determined as follows: |
|
1396 |
|
1397 \medskip |
|
1398 \begin{tabular}{llll} |
|
1399 goal & & arguments & rule \\\hline |
|
1400 & @{method coinduct} & @{text x} & type coinduction (type of @{text x}) \\ |
|
1401 @{text "A x"} & @{method coinduct} & @{text "\<dots>"} & predicate/set coinduction (of @{text A}) \\ |
|
1402 @{text "\<dots>"} & @{method coinduct} & @{text "\<dots> rule: R"} & explicit rule @{text R} \\ |
|
1403 \end{tabular} |
|
1404 |
|
1405 Coinduction is the dual of induction. Induction essentially |
|
1406 eliminates @{text "A x"} towards a generic result @{text "P x"}, |
|
1407 while coinduction introduces @{text "A x"} starting with @{text "B |
|
1408 x"}, for a suitable ``bisimulation'' @{text B}. The cases of a |
|
1409 coinduct rule are typically named after the predicates or sets being |
|
1410 covered, while the conclusions consist of several alternatives being |
|
1411 named after the individual destructor patterns. |
|
1412 |
|
1413 The given instantiation refers to the \emph{suffix} of variables |
|
1414 occurring in the rule's major premise, or conclusion if unavailable. |
|
1415 An additional ``@{text "taking: t\<^sub>1 \<dots> t\<^sub>n"}'' |
|
1416 specification may be required in order to specify the bisimulation |
|
1417 to be used in the coinduction step. |
|
1418 |
|
1419 \end{description} |
|
1420 |
|
1421 Above methods produce named local contexts, as determined by the |
|
1422 instantiated rule as given in the text. Beyond that, the @{method |
|
1423 induct} and @{method coinduct} methods guess further instantiations |
|
1424 from the goal specification itself. Any persisting unresolved |
|
1425 schematic variables of the resulting rule will render the the |
|
1426 corresponding case invalid. The term binding @{variable ?case} for |
|
1427 the conclusion will be provided with each case, provided that term |
|
1428 is fully specified. |
|
1429 |
|
1430 The @{command "print_cases"} command prints all named cases present |
|
1431 in the current proof state. |
|
1432 |
|
1433 \medskip Despite the additional infrastructure, both @{method cases} |
|
1434 and @{method coinduct} merely apply a certain rule, after |
|
1435 instantiation, while conforming due to the usual way of monotonic |
|
1436 natural deduction: the context of a structured statement @{text |
|
1437 "\<And>x\<^sub>1 \<dots> x\<^sub>m. \<phi>\<^sub>1 \<Longrightarrow> \<dots> \<phi>\<^sub>n \<Longrightarrow> \<dots>"} |
|
1438 reappears unchanged after the case split. |
|
1439 |
|
1440 The @{method induct} method is fundamentally different in this |
|
1441 respect: the meta-level structure is passed through the |
|
1442 ``recursive'' course involved in the induction. Thus the original |
|
1443 statement is basically replaced by separate copies, corresponding to |
|
1444 the induction hypotheses and conclusion; the original goal context |
|
1445 is no longer available. Thus local assumptions, fixed parameters |
|
1446 and definitions effectively participate in the inductive rephrasing |
|
1447 of the original statement. |
|
1448 |
|
1449 In @{method induct} proofs, local assumptions introduced by cases are split |
|
1450 into two different kinds: @{text hyps} stemming from the rule and |
|
1451 @{text prems} from the goal statement. This is reflected in the |
|
1452 extracted cases accordingly, so invoking ``@{command "case"}~@{text |
|
1453 c}'' will provide separate facts @{text c.hyps} and @{text c.prems}, |
|
1454 as well as fact @{text c} to hold the all-inclusive list. |
|
1455 |
|
1456 In @{method induction} proofs, local assumptions introduced by cases are |
|
1457 split into three different kinds: @{text IH}, the induction hypotheses, |
|
1458 @{text hyps}, the remaining hypotheses stemming from the rule, and |
|
1459 @{text prems}, the assumptions from the goal statement. The names are |
|
1460 @{text c.IH}, @{text c.hyps} and @{text c.prems}, as above. |
|
1461 |
|
1462 |
|
1463 \medskip Facts presented to either method are consumed according to |
|
1464 the number of ``major premises'' of the rule involved, which is |
|
1465 usually 0 for plain cases and induction rules of datatypes etc.\ and |
|
1466 1 for rules of inductive predicates or sets and the like. The |
|
1467 remaining facts are inserted into the goal verbatim before the |
|
1468 actual @{text cases}, @{text induct}, or @{text coinduct} rule is |
|
1469 applied. |
|
1470 *} |
|
1471 |
|
1472 |
|
1473 subsection {* Declaring rules *} |
|
1474 |
|
1475 text {* |
|
1476 \begin{matharray}{rcl} |
|
1477 @{command_def "print_induct_rules"}@{text "\<^sup>*"} & : & @{text "context \<rightarrow>"} \\ |
|
1478 @{attribute_def cases} & : & @{text attribute} \\ |
|
1479 @{attribute_def induct} & : & @{text attribute} \\ |
|
1480 @{attribute_def coinduct} & : & @{text attribute} \\ |
|
1481 \end{matharray} |
|
1482 |
|
1483 @{rail " |
|
1484 @@{attribute cases} spec |
|
1485 ; |
|
1486 @@{attribute induct} spec |
|
1487 ; |
|
1488 @@{attribute coinduct} spec |
|
1489 ; |
|
1490 |
|
1491 spec: (('type' | 'pred' | 'set') ':' @{syntax nameref}) | 'del' |
|
1492 "} |
|
1493 |
|
1494 \begin{description} |
|
1495 |
|
1496 \item @{command "print_induct_rules"} prints cases and induct rules |
|
1497 for predicates (or sets) and types of the current context. |
|
1498 |
|
1499 \item @{attribute cases}, @{attribute induct}, and @{attribute |
|
1500 coinduct} (as attributes) declare rules for reasoning about |
|
1501 (co)inductive predicates (or sets) and types, using the |
|
1502 corresponding methods of the same name. Certain definitional |
|
1503 packages of object-logics usually declare emerging cases and |
|
1504 induction rules as expected, so users rarely need to intervene. |
|
1505 |
|
1506 Rules may be deleted via the @{text "del"} specification, which |
|
1507 covers all of the @{text "type"}/@{text "pred"}/@{text "set"} |
|
1508 sub-categories simultaneously. For example, @{attribute |
|
1509 cases}~@{text del} removes any @{attribute cases} rules declared for |
|
1510 some type, predicate, or set. |
|
1511 |
|
1512 Manual rule declarations usually refer to the @{attribute |
|
1513 case_names} and @{attribute params} attributes to adjust names of |
|
1514 cases and parameters of a rule; the @{attribute consumes} |
|
1515 declaration is taken care of automatically: @{attribute |
|
1516 consumes}~@{text 0} is specified for ``type'' rules and @{attribute |
|
1517 consumes}~@{text 1} for ``predicate'' / ``set'' rules. |
|
1518 |
|
1519 \end{description} |
|
1520 *} |
|
1521 |
|
1522 end |